Method and system for authentication by intermediaries
A method and system for authenticating applications. The method includes receiving, by a service virtual machine (SVM), a secret from a management service. The SVM is executing on a computing device. The method also includes providing, by the SVM, the secret to an application executing on an application virtual machine (AVM). The AVM is executing on the computing device. The method further includes providing, by the application, the secret to a remote application server in order for the remote application server to authenticate the application.
1. A method for authenticating applications, comprising:
providing at least one integrity measurement for a computing device to a management service;
after the providing, and upon an integrity confirmation for the computing device, based on, at least in part, a successful verification of the at least one integrity measurement, by the management service:
receiving, by a service virtual machine (SVM) of a server executing on the computing device, a secret from the management service, wherein the SVM is executing on the computing device;
receiving, by the SVM, a request to connect to a remote application server from an application executing on an application virtual machine (AVM) of the server, wherein the AVM is executing on the computing device;
providing, by the SVM, the secret to the remote application server in order for the remote application server to authenticate the application, wherein the secret is not provided to the application.
2. The method of claim 1 , further comprising:
after providing the secret to the remote application server:
receiving, by the SVM, a notification that the remote application server has authenticated the application; and
connecting, by the application, to the remote application server, via the SVM, after the SVM receives the notification.
3. The method of claim 1 , wherein the secret is generated by the management service.
4. The method of claim 1 , wherein the secret is generated by the remote application server and wherein the management service obtains the secret from the remote application server.
5. The method of claim 1 ,
wherein the at least one integrity measurement for the computing device comprises an integrity measurement for a network adapter, generated by a trusted platform module (TPM) of the network adaptor, and
wherein the network adapter is operatively connected to the server, in the computing device.
6. The method of claim 1 , wherein the secret is only valid to authenticate the application executing on the computing device.
7. The method of claim 1 , wherein the secret is only valid for a finite duration.
8. The method of claim 1 , wherein the at least one integrity measurement for the computing device comprises an integrity measurement for the server generated by a trusted platform module (TPM) in the server.
9. A computing device, comprising:
a server configured to provide at least one integrity measurement for the server to a management service for verification of the server, wherein the server comprises:
a service virtual machine (SVM) executing on the computing device and configured to:
upon confirmation of an integrity of the server based on a successful verification of the at least one integrity measurement by the management service:
receive a secret from the management service;
receive a request to connect to a remote application server from an application executing on an application virtual machine (AVM);
provide the secret to the remote application server in order for the remote application server to authenticate the application, wherein the secret is not provided to the application; and
an application virtual machine comprising the application and configured to:
send, to the SVM, the request from the application to connect to the remote application server.
10. The computing device of claim 9 , further comprising:
a network adaptor operatively connected to the server comprising a trusted platform module (TPM) configured to generate at least one integrity measurement of the network adaptor,
wherein the network adaptor is configured to provide the at least one integrity measurement for the network adaptor to the management service prior to the computing device receiving the secret.
11. The computing device of claim 9 , wherein the secret is generated by at least one selected from a group consisting of the management service and the remote application server.
12. The computing device of claim 9 , wherein the secret is only valid to authenticate the application executing on the computing device.
13. The computing device of claim 9 , wherein the secret is only valid for a finite duration.
14. The computing device of claim 9 , wherein the server further comprises a trusted platform module (TPM) configured to generate the at least one integrity measurement for the server.